CVE-2026-2688 — CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass

CVE-2026-2688

CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass PUBLISHED

Description (CNA)

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.

Affected (CNA)

Vendor / product	Versions
Unknown / HIPAA FORMS	affected 0 before 3.2.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/779304f2-7dc2-4f12-b134-dede9a0c5eb6/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.